CVE-2026-20358
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in Cisco Crosswork related to external control of file system (CWE-73). Discovered during internal security review, fixed in hardening release.
Risk Assessment
Attacker may manipulate file paths, leading to unauthorized data access or system modification.
Recommendation
Install the latest Cisco Crosswork version with security fixes.
Other vulnerabilities in Cisco Crosswork
See all- CVE-2026-20359Critical
Vulnerability in Cisco Crosswork related to insufficiently protected credentials (CWE-522). It was discovered during an internal security review and addressed in a hardening release.
- CVE-2026-20357Critical
Vulnerability in Cisco Crosswork due to missing authentication for critical functions (CWE-306). Discovered during internal security review, fixed in hardening release.
- CVE-2026-20030Critical
Vulnerability in Cisco Crosswork related to improper neutralization of special elements used in a SQL command (CWE-89), i.e., SQL injection. Discovered during internal security review, fixed in hardening release.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20358 are related to external control of the file system issues that are grouped Common Weakness Enumeration (CWE) CWE-73.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS